Computational Storage Attack Thresholding for Resource Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computational storage devices (CSDs) are vulnerable to attacks from malicious entities that continuously issue computational storage requests, leading to performance degradation and resource exhaustion.
Innovation Solution
Implementing an attack prevention threshold (APT) system that identifies attackers by tracking attack counts, maintains a blacklist, and filters out malicious requests, stops CS applications, and reclaims resources using a CSD system architecture with a controller, processing device, and memory to manage program slots and permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If CSD allows executable programs to be stored and executed, then computation functions and data storage are provided with CPU overhead offloading capability, but security risk to CSD components increases
Solution Approach 1:
The system performs preliminary actions by establishing an Attack Prevention Threshold (APT) before attacks occur. When a user's attack count reaches the APT threshold, the system proactively identifies the user as an attacker and blocks their access, preventing further malicious operations before they can cause harm.
Solution Approach 2:
The system introduces an intermediary mechanism - the APT threshold - that mediates between legitimate computational requests and malicious attacks. This threshold acts as a filter that distinguishes normal usage patterns from attack behavior, allowing the system to respond appropriately without blocking legitimate users.
2Measurement precision
If CSD continuously monitors and tracks attack counts from user devices, then attacker identification accuracy improves, but system complexity and resource consumption increase
Solution Approach 1:
The system changes the parameter of monitoring from tracking individual attack details to counting aggregate attack frequency. By focusing on the quantity of attacks rather than analyzing each attack's characteristics, the system achieves accurate attacker identification with reduced monitoring complexity and resource consumption.
Solution Approach 2:
The system applies partial action by monitoring only the attack count parameter rather than all possible attack attributes. This selective monitoring approach provides sufficient accuracy for attacker identification while significantly reducing the complexity of the monitoring system.
3Reliability
If CSD blocks all requests from identified attackers, then security and resource protection are improved, but legitimate users may be incorrectly blocked if threshold is not properly calibrated
Solution Approach 1:
The system implements feedback by continuously monitoring attack counts and comparing them against the APT threshold. When the threshold is reached, the system feedbacks by blocking the user and can adjust the threshold based on observed patterns, preventing both attacks and false positives through adaptive response.
Solution Approach 2:
The APT threshold is designed to be dynamic rather than static. The system can adjust the threshold value based on system conditions, attack patterns, and operational context, allowing it to adapt to changing circumstances and reduce false positives while maintaining security protection.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computational storage device, CSD, and a method thereof are provided. The method includes receiving, from a user device, a computational storage, CS, request, identifying the CS request as an attack, comparing a total attack value of the user device to a threshold, wherein the total attack value is based on a number of attacks received from the user device, and identifying the user device as an attacker based on the comparison.